Cursor Pulls 2 Malicious Claude Code Versions After 11-Hour SSH Backdoor Exposure
Updated
Updated · InfoWorld · Nov 2
Cursor Pulls 2 Malicious Claude Code Versions After 11-Hour SSH Backdoor Exposure
3 articles · Updated · InfoWorld · Nov 2
Summary
Versions 2.1.312 and 2.1.313 of Anthropic’s Claude Code extension were available in Cursor’s marketplace for about 11 hours on Oct. 29 before Cursor removed them and temporarily shut the marketplace.
Phorion found the tampered extension executed on load without user interaction, trying to add an attacker-controlled SSH key, create persistence, open local SSH access and establish a reverse tunnel.
Cursor said enabling SSH would generally fail without administrator privileges on Windows and macOS, but the malware could still plant keys, leave scripts outside the extension directory and exfiltrate host details.
Anthropic said its own systems and official distribution channels were not compromised; the attacker used access to Cursor’s marketplace, making the incident limited to Cursor users.
Microsoft said the code gathered machine and user metadata and up to 40 environment-variable names matching terms like KEY, TOKEN, AWS or GCP, underscoring wider software supply-chain risks in extension marketplaces.